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ABSTRACT 


Various variants of Parikh automata on infinite words have recently 
been introduced and studied in the literature. However, with some 
exceptions only their non-deterministic versions have been studied. 
In this paper we study the deterministic versions of all variants of 
Parikh automata on infinite words that have not yet been studied in 
the literature. We compare the expressiveness of the deterministic 
models, study their closure properties and decision problems with 
applications to model checking. The model of deterministic limit 
Parikh automata turns out to be most interesting, as it is the only 
deterministic Parikh model generalizing the w-regular languages, 
the only deterministic Parikh model closed under the Boolean op- 
erations and the only deterministic Parikh model for which all 
common decision problems are decidable. 
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1 INTRODUCTION 


Finite automata operating on infinite words find many applica- 
tions in the world of formal languages, logic, formal verification, 
games, and many more. In many scenarios, non-determinism adds 
expressiveness or succinctness to their deterministic counterparts. 
However, this often comes at the price of important decision prob- 
lems becoming hard to solve, or even undecidable [4, 23]. 

This is not only true for the most common model of finite au- 
tomata operating on infinite words, namely Büchi automata (which 
recognize the w-regular languages), but also for various extensions 
leaving the w-regular realm. These include Parikh automata (PA) on 
infinite words, which gained a lot of attention just recently [11, 12]. 
Such automata are equipped with a constant number of coun- 
ters (positive integers), and the counter values can be checked 
to satisfy some linear constraints. Several acceptance conditions 
for Parikh automata on infinite words have been studied in the 
literature, including deterministic and non-deterministic reacha- 
bility PA, safety PA, Biichi PA and co-Biichi PA [12], as well as 
non-deterministic limit PA, reachability-regular PA, and strong and 
weak reset PA [11]. For all of these models, except safety PA and 
co-Biichi PA, testing emptiness is coNP-complete and universality 
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is undecidable [11, 12]. In contrast, for safety PA and co-Biichi PA, 
both problems are undecidable; however, requiring determinism 
yields a coNP-complete universality problem. 

This motivates the study of the deterministic variants of the 
remaining models, namely deterministic limit PA, reachability- 
regular PA, strong reset PA, and weak reset PA. In this paper we 
study their expressiveness, closure properties and common deci- 
sion problems. Grobler et al. [11] have shown that almost all non- 
deterministic variants of the aforementioned models (the exception 
being safety PA and co-Biichi PA again) form a hierarchy: 


reach PA G reachability-regular PA = limit PA 
Büchi PA C weak reset PA = strong reset PA. 


IN 


First, we show that this is not the case for their deterministic 
variants. While 


deterministic strong reset PA C deterministic weak reset PA 
and 


deterministic reachability PA 
G deterministic reachability-regular PA 


C deterministic weak reset PA 


still holds, all other models become pairwise incomparable. Further- 
more, we show that among all studied deterministic models only 
deterministic limit PA generalize Biichi automata in the sense that 
they recognize all w-regular languages. 

Deterministic limit PA also shine in the light of closure properties: 
among all studied PA operating on infinite words (the deterministic 
variants as well as the non-deterministic ones) they are the only 
ones closed under union, intersection and complement. This benefit 
also yields decidable decision problems. In contrast to the other 
models that were studied in [11, 12], emptiness and universality 
are decidable for deterministic limit PA. We show that also strong 
reset PA benefit from determinism: although having bad closure 
properties their universality problems becomes decidable. However, 
as we show, for deterministic reachability-regular PA and determin- 
istic weak reset PA the universality problem remains undecidable. 


deterministic limit PA 
deterministic reachability-regular PA 


deterministic weak reset PA 


x x x S Íc 
x x x SD 
xX x x S 


deterministic strong reset PA 


Table 1: Closure properties. 


L=9? w®e€eL? Laser 
det. limit PA coNP-c. NP-c. decidable 
det. reach-reg. PA coNP-c. NP-c. undecidable 
det. weak reset PA | coNP-c. NP-c. undecidable 
det. strong reset PA | coNP-c. NP-c. decidable 


Table 2: Decision problems. 


Finally, we study their inclusion and intersection emptiness prob- 
lems, as these are important problems in order to study model 
checking problems. Here, we are given a system K as a Kripke 
structure (a safety automaton) or a PA and a specification A as 
a PA. The question whether at least one computation of a Kripke 
structure satisfies the specification (which we call existential safety 
model checking) has been studied in [11]. The authors show that 
this problem is coNP-complete for (nondeterministic) reset PA and 
for all models that are weaker. Similarly, the question whether all 
computations of a PA satisfy the specification (which we call uni- 
versal PA model checking) has been studied in [12]. The authors 
show that this problem is coNP-complete for deterministic safety 
and co-Buchi PA, and undecidable for their nondeterministic coun- 
terparts as well as for deterministic reachability and Biichi PA. We 
study this problem as well as the universal safety model checking 
problem and the existential PA model checking problem for the re- 
maining deterministic models. Again, deterministic limit PA shine 
as all these problems are decidable for them. For the other models, 
some problems are decidable and some are not. 

In the following table we list our results. Some of the questions 
have already been studied in the literature or follow immediately 
from the results of [11, 12]. We fill the missing gaps and remark 
that these results are the technically most demanding results of this 


paper. 


Model Checking 
Kripke PA 
a | y a | y 
det. limit PA vui] vy v y 
det. reach-reg. PA v [11] x v x 
det. weak reset PA | /[11] X x x 
det. strong reset PA | v [11] vV x y 
det. reachability PA | v [11] X [12] v [2] xX [12] 
det. Büchi PA si] xaJ s x [12] 
det. safety PA x02] v [2] xX[12] v [12] 
det. co-Büchi PA x02] v [12] xX[12] v [12] 


Table 3: Decidability of the model checking problem. 


1.1 Related work 


Parikh automata on finite words were introduced by Klaedtke and 
Ruess in [18] in order to show that an extension of weak monadic 
second-order logic (MSO) with cardinality constraints is decid- 
able. PA turn out to be equivalent to Ibarra’s reversal bounded multi- 
counter machines [17] and Greibach’s blind counter machines [10], 
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which are also known as integer vector addition systems with states 
(Z-VASS) [14]. Furthermore, they can be efficiently translated into 
each other [1]. The study of Parikh automata on infinite words 
was initiated just recently by Guha et al. [12], followed by [11]. 
Closely related to PA on infinite words are blind counter machines 
on infinite words, as introduced by Fernau and Stiebe [7]. Indeed, 
these machines turn out to be equivalent to Büchi PA [11]. Another 
model of automata with counters on infinite words are Büchi VASS. 
A recent result by Baumann et al. shows that their regular separabil- 
ity problem (that is, the question whether an w-regular languages 
separates two w-languages recognized by Büchi VASS) is decid- 
able [2]. Another recent work shows the impact of PA on infinite 
words. Herrmann et al. [16] introduce a logic subsuming count- 
ing MSO and Boolean algebra with Presburger arithmetic, and 
show decidability over labeled infinite binary trees by introducing 
Parikh-Muller tree automata (which can be seen as an extension 
of reachability-regular PA to trees). Yet another recent work by 
Bergsträßer et al. [3] shows that Ramsey quantifiers in Presburger 
arithmetic can be eliminated efficiently. Such a quantifier basically 
asks for the existence of an infinite clique in the graph induced 
by some formulas. The authors show that their results strengthen 
recent results on PA on infinite words. We use these results on 
Ramsey quantifiers to give an explicit application, namely that in- 
tersection emptiness of two Büchi PA is decidable, and hence their 
existential PA model checking problem. 


2 PRELIMINARIES 


2.1 Finite and infinite words 


We write Z for the set of all integers and N for the set of non- 
negative integers including 0. Furthermore, let No = N U {oo}. 
Throughout the paper we use the variables c, d, k, £, m, n, z to denote 
positive integers and we will tacitly assume this without explicit 
mention. Let È be an alphabet, i.e., a finite non-empty set and let £* 
be the set of all finite words over =. For a word w € £*, we denote 
by |w] the length of w, and by |w]a the number of occurrences of 
the letter a € X in w. We write e for the empty word of length 0. 

An infinite word over an alphabet È is a function a : N\ {0} > È. 
We often write aj instead of a(i). Thus, we can understand an 
infinite word as an infinite sequence of symbols a = œ a243... 
For m < n, we abbreviate the finite infix &m ...&n by a[m : n]. 
We denote by =° the set of all infinite words over ©. We call a 
subset L C X° an w-language. Moreover, for L C >*, we define 
L? = {wiw2: +; | wi € L \ {e}} © E®. We call a non-empty w- 
language L C X° ultimately periodic if it contains an infinite word 
of the form uv® for finite words u,v € &*. We refer to such infinite 
words also as ultimately periodic. 


2.2 Regular and w-regular languages 


A non-deterministic finite automaton (NFA) is a schnuple A = 
(Q, È, qo, A, F), where Q is a finite set of states, È is the input al- 
phabet, go € Q is the initial state, A C Q x È x Q is the set of 
transitions and F C Q is the set of accepting states. We call A 
deterministic if for every pair (p,a) € Q X = there is exactly one 
transition of the form (p,a,q) € A for some q € Q. A run of A 
on a word w = w1...Wn E 2* is a (possibly empty) sequence 
of transitions r = r1...rn with ri = (pi-1,wi pi) € A such 
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that po = qo. We say r is accepting if pn € F. The empty run 
on € is accepting if qo € F. We define the language recognized by 
A as L(A) = {w € £” | there is an accepting run of A on w}. Ifa 
language L is recognized by some NFA A, we call L regular. 

A Biichi automaton is an NFA A = (Q,%,qo, A, F) that takes 
infinite words as input. A run of A on an infinite word a,a2a3... 
is an infinite sequence of transitions r = rjrar3... with r; = 
(pi-1, &i, pi) € A such that po = qo. We say r is accepting if there 
are infinitely many i with p; € F. We define the w-language recog- 


nized byA as Lo (A) = {a € X° | there is an accepting run of A on a}. 


If an w-language L is recognized by some Biichi automaton A, we 
call L w-regular. If every state of a Büchi automaton A is accepting, 
we call A a safety automaton. Similarly, a Muller automaton is a 
tuple A = (Q, È, qo, A, F), where Q, È, qo, and A are defined as 
for Biichi automata, and F c 22 is a collection of sets of accept- 
ing states. Runs are defined as for Biichi automata, and a run r 
is accepting if the sets of states that appear infinitely often in r 
is contained in F. Deterministic Muller automata have the same 
expressiveness as non-deterministic Biichi automata [20]. How- 
ever, deterministic Biichi automata are less expressive than their 
non-deterministic counterpart [19]. If an w-language L is recog- 
nized by some deterministic Biichi automaton, we call L deter- 
ministic w-regular. For a (finite word) language L C £*, we define 
L= {a € xX | a[1: i] € L for infinitely many i}. An w-language L 
is deterministic w-regular if and only if L = W fora regular lan- 
guage W [19]. 


2.3 Semi-linear sets 


A linear set (of dimension d > 1) is a set of the form C(b, P) = 
{b+piz1+---+peze | z1,... ze EN} C N4, where b € Nf and P = 
{p1,.--, pe} C N@ is a finite set of vectors for some £ > 0. We call b 
the base vector and P the set of period vectors. A semi-linear set is a fi- 
nite union of linear sets. We also consider semi-linear sets over NĀ, 
that is, semi-linear sets with an additional symbol co for infinity. As 
usual, addition of vectors and multiplication of a vector with a num- 
ber is defined component-wise, where z + 00 = 00 + z = c0 + œ = 00 
for all z € N, z - œ = œ - z = œ for all z > 1, and 0 - œ = œ - 0 = 0. 
For vectors u = (u1, ..., uc) € NS and v = (01, ... 04) € NÅ, we 
denote by u- v = (u1, ..., Uc, U1,- ..,Ud) € Netd the concatenation 
ofu and v. We extend this definition to sets of vectors. Let C C NS 
and D c N4. Then C-D = {u-v | u € C,v € D} c N&t4. We denote 
by 0% the d-dimensional all-zero vector, by 1¢ the d-dimensional 
all-one-vector, by ed the d-dimensional vector where the ith entry 
is 1 and all other entries are 0, and by id the d-dimensional vector 
where the ith entry is œ and all other entries are 0. We often drop 
the superscript d if the dimension is clear. 


2.4 Parikh-recognizable languages 


A Parikh automaton (PA) is a tuple A = (Q, È, qo, A, F, C) where 
Q, È, qo, and F are defined as for NFA, A C Ox 2 xX Ni x Q, for 
some d > 1, is a finite set of labeled transitions, and C C Nf isa 
semi-linear set. We call d the dimension of A and interpret d as a 
number of counters. Analogously to NFA, we call A deterministic if 
for every pair (p,a) € Q x È there is exactly one labeled transition 
of the form (p,a, v,q) € A for some v € N? and q € Q. A run 


of A on a word w = x1 ... Xn is a (possibly empty) sequence of 
labeled transitions r = r1 .. . rn with rj = (pi-1, Xi, Vi, pi) € A such 
that po = qo. We define the extended Parikh image of a run r as 
P(r) = }Zi<n Vi (with the convention that the empty sum equals 0). 
We say r is accepting if pn € F and p(r) € C, referring to the latter 
condition as the Parikh condition. The language recognized by A is 
L(A) = {w € X* | there is an accepting run of A on w}. 


3 PARIKH AUTOMATA ON INFINITE WORDS 


In this section, we recall the acceptance conditions of Parikh au- 
tomata operating on infinite words that were studied before in the 
literature. 


Let A = (Q, È, qo, A, F, C) be a PA. A run of A on an infinite 
word q = a1 a2a@3... is an infinite sequence of labeled transitions 
r = ryrerg... with r; = (pi-1, aj, Vi pi) € A such that po = 
qo. The automata defined below differ only in their acceptance 
conditions, hence they are syntactically equivalent but semantically 
different (the notion of determinism translates directly). In the 
following, whenever we say that an automaton A accepts an infinite 
word a, we mean that there is an accepting run of A on a. We begin 
with the models studied by Guha et al. [12], who also studied the 
deterministic variants of the these models. 


(1) The run r satisfies the safety condition if for every i > 0 we 
have pj € F and p(r1 ... ri) € C. We call a PA accepting 
with the safety condition a safety PA [12]. We define the 
w-language recognized by a safety PA A as 


So lA) = {a € Z? | A accepts a}. 


(2) The run r satisfies the reachability condition if there is an 
i > 1 such that p; € F and p(r, ... ri) € C. We say there 
is an accepting hit in rj. We call a PA accepting with the 
reachability condition a reachability PA [12]. We define the 
w-language recognized by a reachability PA A as 


Ro (A) = {a € X? | A accepts a}. 


(3) The run r satisfies the Bichi condition if there are infinitely 
many i > 1 such that p; € F and p(r1 ... ri) € C. We call 
a PA accepting with the Biichi condition a Büchi PA [12]. 
We define the w-language recognized by a Büchi PA A as 


Ba (A) = {a € £? | A accepts a}. 


(4) The run r satisfies the co-Biichi condition if there is ig such 
that for every i > ig we have p; € F and p(r1 ...r;) € C. 
We call a PA accepting with the co-Biichi condition a co- 
Biichi PA [12]. We define the w-language recognized by a 
co-Biichi PA A as 


CBo (A) = {a € 2° | A accepts a}. 


Furthermore, Guha et al. [12] assume that reachability PA are 
complete, i.e., for every (p,a) € Q x È there are v € N? and qEQ 
such that (p, a, v, q) € A, as incompleteness allows to express addi- 
tional safety conditions. We also make this assumption in order to 
study “pure” reachability PA. In fact, we can assume that all models 
are complete, as the other models can be completed by adding a 
non-accepting sink. Observe that their deterministic variants are 
always complete by definition. 


Now we recall the models introduced in [11]. 


(5) The run satisfies the reachability and regularity condition 
if there is ani > 1 such that p; € F and p(r1...1ri) € C, 
and there are infinitely many j > 1 such that p; € F. We 
call a PA accepting with the reachability and regularity 
condition a reachability-regular PA [11]. We define the w- 
language recognized by a reachability-regular PA A as 


RRw(A) = {a € X? | A accepts a}. 


(6) The run satisfies the limit condition if there are infinitely 
many i > 1 such that p; € F, and if additionally p(r) € C, 
where the jth component of p(r) is computed as follows. If 
there are infinitely many i > 1 such that the jth component 
of v; has a non-zero value, then the jth component of p(C) 
is oo. In other words, if the sum of values in a component 
diverges, then its value is set to co. Otherwise, the infinite 
sum yields a positive integer. We call a PA accepting with 
the limit condition a limit PA [11]. We define the w-language 
recognized by a limit PA A as 


Lo lA) = {a € £? | A accepts a}. 


(7) The run satisfies the strong reset condition if the following 
holds. Let ko = 0 and denote by kı < k2 < ... the posi- 
tions of all accepting states in r. Then r is accepting if the 
sequence kj, k2,... is infinite and p(rg,_,41---Tk,) € C 
for all i > 1. We call a PA accepting with the strong reset 
condition a strong reset PA [11]. We define the w-language 
recognized by a strong reset PA A as 


SRo (A) = {a € £P | A accepts a}. 


(8) The run satisfies the weak reset condition if there are in- 
finitely many reset positions 0 = ko < kı < k2... such 
that p,, € F and p(rg, ,41---%,) € C for alli > 1. We 
call a PA accepting with the weak reset condition a weak 
reset PA [11]. We define the w-language recognized by a 
weak reset PA A as 


WR, (A) = {a € XP | A accepts a}. 


Intuitively worded, whenever a strong reset PA enters an accept- 
ing state, the Parikh condition must be satisfied. Then the counters 
are reset. Similarly, a weak reset PA may reset the counters when- 
ever there is an accepting hit, and they must reset infinitely often, 
too. The equivalence of the (non-deterministic variants of the) two 
models is shown in [11]. Furthermore, it is shown in [11] that 
(non-deterministic) limit PA and (non-deterministic) reachability- 
regular are equivalent, as they recognize exactly w-languages of the 
form U; UiV,°, where the Uj are (finite word) languages recognized 
by PA, and the V; are regular languages. 


4 EXPRESSIVENESS 


In this section we study the expressiveness of deterministic PA on 
infinite words for those models whose deterministic variants were 
not studied before in the literature. When we show non-inclusions, 
we always give the strongest separation. By abuse of notation we 
simply write that a model is a strict/no subset of another model; by 
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that we mean that the class of w-languages recognized by the first 
model is a strict/no subset of the class of w-languages recognized 
by the second model. 


4.1 w-regular languages 


We begin by showing that every w-regular language is deterministic 
limit PA recognizable. 


LEMMA 4.1. w-regular Ç deterministic limit PA. 


Proor. Let L C X° be w-regular and let A = (Q, È, qo, A, F) be 
a deterministic Muller automaton recognizing L. The idea is to con- 
struct an equivalent deterministic limit PA A’ = (Q, £, go, A’, Q, C) 
of dimension |Q], where every state is accepting, while encoding 
the sets in F into the semi-linear set C. Let f : Q > {1,...,|Q|} be 
a bijection associating every state with a counter. Hence, we define 


AN’ = {(p,4, ered) | (p,a,q) € A}. For every F € F, we define 


Cr = C(Xiger icq), {€f(q) | q £ F}). That is, for every state in F 
we expect its counter value to be œ, while we expect every other 
counter value to be a finite number. We choose C = U pep Cr and 
hence obtain an equivalent deterministic limit PA. 

The strictness is witnessed by the w-language {a”b"c® | n > O}, 
which is obviously deterministic limit PA recognizable, but not 
w-regular. o 


It turns out that all other models do not recognize all regular 
w-languages. 


LEMMA 4.2. 


Deterministic reach-reg. PA 

Deterministic Biichi PA 
w-regular $ en 

Deterministic strong reset PA 


Deterministic weak reset PA 


Proor. None of these PA recognize Laco = {a € {a,b}® | 
|a@la < co}, which is obviously w-regular. The proof that these 
models do not recognize Lg<oo mimics the standard proof showing 
that this w-language is not deterministic w-regular, see e.g. [22]. 
mi 


Observe however these models generalize deterministic Büchi 
automata. This however is not true for deterministic reach PA, 
deterministic safety PA nor deterministic co-Büchi PA, as shown 
in the next lemma. 


LEMMA 4.3. 
Deterministic reach PA 


Deterministic safety PA 


Deterministic co-Büchi PA 


Deterministic w-regular ¢ 


Proor. As an immediate consequence of Lemma 4.5 (proved 
below) we have that no deterministic reach PA recognizes the de- 
terministic w-regular language a*b®. 

Guha et al. [12] have shown that (even non-deterministic) safety 
PA do not recognize the det. w-regular language {a, b}@ \ {a}®. 

Finally, dually to the previous proof we can show that no co- 
Biichi PA recognizes the deterministic w-regular language Lg=oo = 
{a € {a, b}® | lala = œ}. Oo 
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4.2 Deterministic Safety PA and co-Biichi PA 


As a consequence of Lemma 4.3 we obtain the following corollary. 


COROLLARY 4.4. 


Deterministic reach-reg. PA 
Deterministic limit PA 
Deterministic Biichi PA £ 
Deterministic strong reset PA 
Deterministic weak reset PA 


Deterministic safety PA 


Deterministic co-Büchi PA 


As shown in [12] also deterministic reach PA ¢ deterministic 
safety PA and deterministic reach PA ¢ deterministic co-Büchi PA. 
Furthermore, the classes of deterministic safety PA and determinis- 
tic co-Büchi PA are themselves incomparable as shown in [12]. 

Vice versa, deterministic safety PA ¢ non-deterministic weak 
reset PA and deterministic co-Biichi PA ¢ non-deterministic weak 
reset PA [11]. Hence, these classes are no subclasses of any of the 
other studied classes. 

Overall, deterministic safety PA and deterministic co-Biichi PA 
are incomparable with all other studied models. 


4.3 Deterministic Reach PA 


We begin by characterizing the class of deterministic reach PA 
recognizable w-languages. 


LEMMA 4.5. An w-language L is deterministic reach PA recogniz- 
able if and only if L = UX®, where U C  &* is recognized by a 
deterministic PA. 


Proor. Let A be a deterministic reach PA recognizing L. Then 
we have L(A) = U. Likewise, if A is a PA recognizing U, then 
Ro (A) = L (recall that A is complete by the definition of deter- 
minism). o 


We have the following strict inclusion. 


LEMMA 4.6. Deterministic reach PA Ç deterministic reach-reg. PA. 


Proor. Let A be a deterministic reach PA. We may assume 
that every state of A is accepting, as we can project the current 
state into the semi-linear set. To be precise, we introduce two new 
counters for each state of A, counting the number of visits and 
exits. Then, the current state is the (unique) state with one more 
visit than exit, or in case that the number of visits and exits is the 
same for every state, then the current state is the initial state of A. 
As these statements can be encoded into a semi-linear set, we can 
assume that every state is equipped with its own semi-linear set, 
and can hence make every state accepting (and assign the empty 
set if we want to simulate a non-accepting state). If every state is 
accepting, then A is an equivalent deterministic reach-reg PA. 

The strictness is witnessed e.g. by the w-language {a"b"a® 
n > 0}, which is deterministic reach-reg PA recognizable and by 
Lemma 4.5 not deterministic reach PA recognizable. o 


It remains to show the following incomparability results. 
LEMMA 4.7. Deterministic reach PA ¢ deterministic limit PA. 
Proor. We show that the deterministic reach PA recognizable 


w-language L = {æ | |a[1: illa = |a[1 : i]|, for some i > 0} is 
not deterministic limit PA recognizable. The proof is similar to the 


proof of Theorem 3 of (the arXiv version of) [12]. Assume there 
is an n-state deterministic limit PA A recognizing L. Consider the 
unique non-accepting run of A on a(a"b”)®. Observe that A visits 
at least one state twice while reading a b”-block, and there are at 
least two of the (infinitely many) b”-blocks such that A visits the 
same state, say q, twice while reading them. Hence, we can shift one 
such q-cycle to the front and obtain the unique run on an infinite 
word that is in L. However, this run is still non-accepting, as the 
extended Parikh image and number of visits of an accepting state 
do not change. o 


LEMMA 4.8. Deterministic reach PA ¢ deterministic strong reset PA. 


Proor. We show that the deterministic reach PA recognizable 
w-language L = {a"b" | n > 1} - {a,b} is not deterministic strong 
reset PA recognizable. Assume there is a deterministic strong re- 
set PA A with n states recognizing L. Let a = a”b® with unique 
accepting run r = ryrar3... of A on a. Let fi, fo,... be the se- 
quence of reset positions of r and let i > n be minimal such that 
i = fy for some i’ > 1 (that is, fy is the first reset position after 
reading a b). 

First observe that i < 2n. Assume that this is not the case. As A 
visits at least one state twice while reading b”, say state q, we 
observe that A is caught in a q...q cycle while reading b® due to 
determinism. That is, every state that is visited while reading b® is 
already visited while reading the first n many bs. Hence we have 
i < 2n. Now let j = 2n be minimal such that j = fj for some 
j’ > i’ isa reset position in r such that the state at position fj is 
the same state as the one at position fy (which exists by the same 
argument). 

Now let a’ = a"b/~"a® with unique accepting run r’ = Nor «+ 
of A on a’. Observe that @[1 : j] = @’[1: j], and hence r[1 : j] = 
r'[1 : j]. As the partial runs r[1 : i] and r[1 : j] reach the same 
accepting state, the run r[1 : i] riaria ... is an accepting run 
of A on a”bi™”a®. However, as i — n < n, this infinite word is not 
contained in L, a contradiction. oO 


4.4 Deterministic Reach-Reg PA 


We begin by showing that the every deterministic reach-reg. PA 
(and hence every deterministic reach PA) can be translated into an 
equivalent deterministic weak reset PA. 


LEMMA 4.9. Deterministic reach-reg. PA G deterministic weak re- 
set PA. 


Proor. Let A = (Q, È, qo, A, F,C) be a det. reach-reg. PA. Let 
A’ =(QU {qo}: x, > A’, F,C’) be a copy of A with a new fresh 
initial state qj inheriting all outgoing transitions of qo (observe 
that this modification preserves determinism). We add one new 
counter that is incremented at every transition leaving qo, and not 
modified otherwise, that is, 


A’ = {(p,a,v -0,q) | (p,a, v,q) € A} 
U {(qo,4v- 1,q) | (q0, a, v, q) € A}. 


We choose C’ = C- {1} UN@- {0} and obtain an equivalent weak 
reset PA A’. 


The strictness is witnessed by the w-language {a”b” | n > 0}®, 
which is obviously deterministic weak reset PA-recognizable, but 
not even recognized by (non-deterministic) Büchi PA, which are 
more expressive than reachability-regular PA [11, 12]. o 


4.5 Deterministic Strong Reset PA 


LEMMA 4.10. Deterministic strong reset PA Ç deterministic weak 
reset PA. 


Proor. The inclusion follows by the same argument as in the 
non-deterministic setting [11] (we use an additional counter to 
force the weak reset PA to reset whenever an accepting state is 
visited). 

The strictness follows from the fact that {a”b” | n > 1}- {a,b}° 
is deterministic reach PA recognizable, and hence deterministic 
weak reset PA recognizable (by Lemma 4.6 and Lemma 4.9), but 
not recognized by any deterministic strong reset PA, as shown in 
Lemma 4.8. o 


LEMMA 4.11. Deterministic strong reset PA $ deterministic Biichi PA. 


Proor. The argument is as in Lemma 4.9. The w-language {a”b” | 
n > 0}® is deterministic strong reset PA recognizable, but there is 
no Biichi PA recognizing it [12]. o 


LEMMA 4.12. Deterministic strong reset PA £ deterministic limit PA. 


Proor. This follows from the previous proof as limit PA are less 
expressive than Büchi PA [11]. o 


4.6 Deterministic Büchi PA 


We show that w-languages recognized by deterministic Büchi PA 
can be characterized in a similar way as deterministic w-regular 
languages. 


LEMMA 4.13. An w-language L is deterministic Büchi PA recogniz- 
able if and only of L = P where P is recognized by a deterministic PA. 


Proor. Let A be a deterministic Büchi PA recognizing L and 
let a € B,(A) with accepting run r. As r has infinitely many 
accepting hits by definition, we have a € L(A). Similarly, let A be a 
deterministic PA recognizing P and let a € P. As A is deterministic, 
the unique run of A on « has infinitely many accepting hits, hence 
we have a € B,(A). o 


LEMMA 4.14. Deterministic Büchi PA ¢ deterministic limit PA. 


Proor. The proof is almost identical to the proof of Lemma 4.7, 
but this time we consider the w-language La- = {a | |a[1: i]la= 
|a[1 : i]|, for co many i}. Then we can re-use the same argument 
as the constructed infinite word has indeed infinitely many balanced 
a-b prefixes. o 


LemMa 4.15. Deterministic Biichi PA ¢ deterministic weak re- 
set PA. 


Proor. Let La=-p be as in the last proof and similarly define 
La=c = {a | |a[1: illa = |a[1: i]|c for co many i}. We show that 
the deterministic Biichi PA recognizable w-language La=p U La=c 
is not deterministic weak reset PA recognizable. Assume there is a 
deterministic weak reset PA A recognizing Lg=p U La=c. Consider 
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the unique accepting run r of A on a = (ab)® and let i, j be two 
positions with i+ 1 < j such that r resets after reading a[1 : i] and 
a[1 : j] in the same state (such a pair of positions does always exists 
by the infinite pigeonhole principle). Now consider the infinite word 
afl: ijcl@lt la (ac), which is also accepted by A. However, this 
implies that A also accepts a[1 : flcl#ltlle(ac)®, as A is in the 
same (accepting) state after reading @[1 : i] as well as a[1 : j], 
but this infinite word is not contained in La=p U Lg=c, as a[1: j] 
contains at least one more a than a@[1 : i], a contradiction. Oo 


We note however that the class of w-languages recognized by 
deterministic Büchi PA with a linear set form a subclass of the class 
of w-languages recognized by deterministic weak reset PA with a 
linear set, as clarified in the following lemma. 


LEMMA 4.16. Let A be a deterministic Büchi PA with a linear 
set C(b, P). Then there is an equivalent deterministic weak reset PA. 


Proor. First we observe that if b = 0, then we have B(A) = 
WRo (A). To see this, let a € Be (A) with (unique) accepting run r. 
By Dickson’s Lemma [6], the run r contains an infinite monotone 
sequence sj < sg < ... of accepting hits, that is, for alli > 0 
we have p(r[1 : sj]) € C(b, P) and for all j > i we have p(r[si + 
1 : sj]) € C(b, P). Hence, the run r also satisfies the weak reset 
condition. For the other direction let a € WR,,(A) with (unique) 
accepting run r and reset positions 0 = kg < kı < kg.... As we 
assume b = 0, it is immediate that p(r[1 : ki]) € C(b, P) for all 
i > 1. Hence, the run r also satisfies the Büchi condition. 

Finally we argue that we can always assume that b = 0. Indeed, 
we can always encode b into the state space of Aj. m] 


5 CLOSURE PROPERTIES 


We study the closure properties of the deterministic variants of 
the models introduced by Grobler et al. [11], that is, deterministic 
limit PA, deterministic reachability-regular PA, deterministic strong 
reset PA, and deterministic weak reset PA. 

It is well known that semi-linear sets over N@ are closed under 
complement [13]. Before we study deterministic limit automata we 
show that this is also true for semi-linear sets enriched with ov. 


Lemma 5.1. LetC C NÉ be a semi-linear set. Then the complement 
c= NZ, \ C is semi-linear. 


Proor. Let f : No — N be the bijection with f(co) = 0 and 
f (i) = i+1 for i € N. We extend f to vectors v = (v1,...,0g) € NZ, 
and sets of vectors C C NZ component-wise: f(v1,...,0q) = 
(f(01),...,f(vg)) and f(C) = {f(v) | v € C}. Note that f(C) € Ni. 

Now we observe that f (C) is semi-linear if and only if C is 
semi-linear. First assume that C is semi-linear. We may assume that 
C = C(b, P) is linear, as we can carry out the following procedure 
for every linear set individually. Assume b = (b1, . . . , bg). We define 
Doo(b) = {i | bi = œ}. For a set D € {1,...,d} with Do(b) € D 
and a vector v = (v1,...,0g) € NĀ, let vP = (eat with 
uP = Oifie D and oP =v; if i ¢ D. Furthermore, we call a subset 
P’ C P of period vectors D-compatible if for every i € D \ Doo(b), 
the set P’ contains at least one vector where the ith component 
is oo, and if for every i ¢ D, the set P’ contains no vector where the 
ith component is œ. Observe that this definition ensures that for 
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every vector v € P’ we have vP € Nf, that is, no component in yP. 


is co. Let PP c 2P be the collection of D-compatible subsets of P. 
Then we have f(C) = Ups (b)cDc{L...d} Upepo C(b? +1P + 
DpeP’ p?, {p? | p € P’}), which is semi-linear by definition. 

For the other direction, we may again assume that f(C) = 
C(b, P) is linear. Similar to above, assume b = (bj,...,bg) and 
define Do(b) = {i | bj = 0}. For a set D C Do(b) we call a sub- 
set P’ C P of period vectors D-safe if for every i € D the set P’ 
contains no vector where the ith component is not 0, and if for 
every i ¢ D the set P’ contains at least one vector where ith com- 
ponent is not 0. Let pp C 2P be the collection of D-safe subsets 
of P. Let ip = (v1,..., 0g) with oj = œ if i € D and v; = Q if i ¢ D. 
Then we have C = Upcpy(b) Uprepp C(ip+b-1+ Xpep: P,P’), 
which is semi-linear by definition (observe that every component 
in ip +b + X pep Pp is strictly greater 0, hence we can subtract 1 
without getting negative; furthermore, we assume oo — 1 = ov). 

As semi-linear sets over Nf are closed under complement, we 
have C is semi-linear iff f(C) is semi-linear iff NI \ f(C) is semi- 
linear iff f~t (Nd \ f(C)) = C is semi-linear. o 


LEMMA 5.2. The class of deterministic limit PA recognizable lan- 
guages is closed under union, intersection and complement. 


Proor. First observe that we can always assume that every 
state of a (deterministic) limit PA is accepting, as we can check the 
existence of an accepting state being visited infinitely often in the 
semi-linear set. To achieve this, we introduce one new counter and 
increment it at every transition that points to an accepting state. In 
the semi-linear set we enforce that this counter is oo. 

Hence, we can show the closure under union and intersection by 
a standard product construction. In case of union, we test whether 
at least one automaton has good counter values, and we can show 
the closure under intersection by testing whether both automata 
have good counter values. Closure under complement follows im- 
mediately from Lemma 5.1. o 


Lemma 5.3. The class of deterministic reach-reg.PA recognizable 
languages is not closed under union, intersection or complement. 


Proor. First we show non-closure under union. Let 
Lı = {uca | u € {a,b,c}, lula = lulp, lale = œ} 


and 
Lz = {vaf | v € {a, b, c}*, lol, = lole, Bla = œ}. 


Both languages are deterministic reach-reg. PA recognizable, as 
witnessed by the automaton in Figure 1 and the fact that L2 can be 
obtained from L by shuffling symbols. We show that the language 
Lı U Lo is not deterministic reach-reg. PA recognizable. Assume 
there is an n-state deterministic reach-reg. PA A recognizing L. 
Then there is a unique accepting run rjr2... of A on abc”. In par- 
ticular, at some point the automaton verifies the Parikh condition, 
say after using the transition r;. Let m = max{n + 1, i} and con- 
sider the infinite word abe b™~1q® with the unique accepting run 
rir.. - of A. Due to determinism, we have rj = r’, for all j < m+2; 
in particular, the automaton verifies the Parikh condition within 
this run prefix. As m — 1 > n, the automaton visits a state, say q 
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Figure 1: The deterministic reach-reg. PA with C = C(0, {1}) 
for Lı = {uca | u € {a, b, c¥*, ula = |ulp, |ale = œ}. 


twice while reading b”"—!. Hence, we can pump this q-cycle and 
obtain an accepting run of A on abe™b'™— 1+ g® for some k > 0, a 
contradiction. 

To show the non-closure under intersection, define Lı = {a | 
la[1 : illa = |a[1 : iļ|p for some i} and Lə = {a | |a[1: illa = 
|a[1 : i]|- for some i}. Suppose there is an n-state deterministic 
reach-reg. PA recognizing L1 N L2. Let a = a(a™b")"*1en(nt +1 go, 
The unique run r of A on a is not accepting, as a has no balanced 
a-b prefix. Observe that A visits at least one state twice while 
reading a b”-block. Furthermore, there is a state, say q, such that A 
visits q twice while reading two different b”-blocks, as there are 
n + 1 different b”-blocks. Hence, we can swap the latter q-cycle 
to the front and obtain an infinite word, say a’ in Lı N L2, witha 
unique accepting run r’ of A. This run verifies the Parikh condition 
at some point. We distinguish two cases. If r’ verifies the Parikh 
condition before reading the first c, we can depump the c”("*+1)+1_ 
block and obtain an accepting run on an infinite word without a 
balanced a-c-prefix, a contradiction. Hence assume that r’ verifies 
the Parikh condition after reading at least one c, say at position k. 
However, then we have p(r[1 : k]) = p(r’[1 : k]), and hence A 
also accepts a, a contradiction. 

The non-closure under complement is witnessed by La<o, see 
Lemma 4.2. Oo 


LEMMA 5.4. The class of deterministic weak reset PA recognizable 
languages is not closed under union, intersection or complement. 


Proor. We begin with the non-closure under union. The w- 
languages La- and Lg=c (as defined in Lemma 4.15) are both de- 
terministic weak reset PA recognizable. As shown in Lemma 4.15, 
their union is not. 

The argument for the non-closure under intersection is the same 
as for the non-deterministic setting [11], which follows from [7] 
and [12]: Let Loa=p = {a | 2ļa[1 : illa = |a[1 : i], for co many i}. 
Then La=b N Log—p is not even ultimately periodic, and hence not 
recognized by any weak reset PA, as they only recognize ultimately 
periodic w-languages [11]. 

The non-closure under complement is again witnessed by Lp <o> 
see Lemma 4.2. o 


LEMMA 5.5. The class of deterministic strong reset PA recognizable 
languages is not closed under union, intersection or complement. 


Proor. We begin with the non-closure under union. Let L = 
{c*a"c*b” | n > O}® and Le=œ = {a | |a|-e = co}. Observe that 
a”c® € LU Le=oo for every n > 0. Assume there is a deterministic 
strong reset PA recognizing L U Le=œ. Let nı + n2 be such that 
the unique accepting runs of A on a = a™c® resp. a2 = a"?c® 
reset in the same state the first time they reset after reading at least 
one c, say after reading a1 [1 : i1] resp. a@2[1 : i2] (with i1 > nı and 
ig > ng). As a™1c1— "1 (ab) is also accepted by A, the infinite 
word a”2¢?2~!2 5" (qb)® is also accepted by A, a contradiction. 

To show the non-closure under intersection, we use an argument 
similar to the non-deterministic setting. Let Lı = {a”b” | n > 0}® 
and Ly = {a}{b" a2" | n > 0}. Then L1 N Lo contains only one infi- 
nite word, namely aba*b2a*b* .... Hence Lı A L2 is not ultimately 
periodic and hence not accepted by any strong reset PA [11]. 


The non-closure under complement again follows from Lemma 4.2. 


Oo 


Finally we remark that deterministic reach-reg. PA, deterministic 
limit PA, deterministic strong reset PA and deterministic weak re- 
set PA are strictly weaker than their non-deterministic counterparts. 
This follows immediately from their different closure properties: 
reach-reg. PA, weak reset PA (and hence strong reset PA) are closed 
under union, and limit PA are not closed under complement [11]. 
The authors do not explicitly mention that limit PA are not closed 
under complement. This however follows from their characteriza- 
tion of limit PA and the fact (non-deterministic finite word) PA are 
not closed under complement [18]. 


6 DECISION PROBLEMS AND MODEL 
CHECKING 


6.1 Decision Problems 


In this section, we consider the following decision problems for PA 
on infinite words. 


e Emptiness: given PA A, is the w-language of A empty? 

e Membership: given PA A and finite words u,v, does A 
accept uv? 

e Universality: given PA A, does A accept every infinite 
word? 


LEMMA 6.1. Emptiness for deterministic limit PA, deterministic 
reach-reg. PA, deterministic weak reset PA and deterministic strong 
reset PA is coNP-complete. 


Proor. Containment in coNP for all models is witnessed by the 
fact that testing non-emptiness for non-deterministic reset PA is 
in NP, and that they generalize all of these models (this follows 
immediately from [11]). 

Hardness is very similar to the finite word case [8], as we can 
reduce subset sum to non-emptiness for all of these models. o 


LEMMA 6.2. Membership for deterministic limit PA, deterministic 
reach-reg. PA, deterministic weak reset PA and deterministic strong 
reset PA is NP-complete. 


Proor. As membership for the non-deterministic counterparts 
of these models is in NP [11], the upper bound follows immediately. 
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Hardness follows from a simple reduction from the membership 
problem for semi-linear sets, that is the question, given a semi- 
linear set C C Nf and a vector v € Nf, is v € C? This problem is 
known to be NP-complete [13]. Oo 


LEMMA 6.3. Universality for deterministic limit PA and determin- 
istic strong reset PA is decidable, while universality for deterministic 
reach-reg. PA and deterministic weak reset PA is undecidable. 


Proor. The decidability result for deterministic limit PA follows 
from the fact that a (deterministic limit) PA A is universal if and 


only if Lo (A) is empty. Now, deterministic limit PA are closed 
under complement by Lemma 5.2 and emptiness is decidable by 
Lemma 6.1. 

In contrast Guha et al. have shown that universality is already 
undecidable for deterministic reach PA [12]. Hence, the undecidabil- 
ity for deterministic reach-reg. PA and deterministic weak reset PA 
follows from Lemmas 4.6 and 4.9. 

Finally we show that universality for deterministic strong re- 
set PA is decidable by reducing it to checking emptiness of the 
complement w-language. Let A be a deterministic strong reset PA. 
Observe that A rejects an infinite word æ whenever one of the 
following two conditions is met: 


(1) The unique run of A on a visits every accepting state just 
finitely often. 

(2) The unique run of A on a@ visits once an accepting state 
with bad counter values. 


The first condition is w-regular, while the second one can be tested 
using reach PA. As the union of an w-regular language and a 
reach PA recognizable language is recognized by a reach-reg. PA, 
for which emptiness is decidable [11], we obtain the desired result. 

Let us begin be showing how a reach PA can test whether a 
deterministic strong reset PA A rejects at least one infinite word a 
because the unique run r of A on « reaches an accepting state 
with bad counter values. Let A = (Q, È, qo, A, F,C) and assume 
that every state in A is reachable from the initial state (otherwise 
they can safely be removed), and that qo ¢ F (this can be done 
by adding a fresh initial state while preserving determinism). Say 
r=rorirg... and0 = ko < kı < kg... are the reset positions. 
Given that ko, kı, k2... is an infinite sequence, there is j > 0 
such that the partial run rk,+1 -- -fk Collects a vector not in C. 
We re-use the following idea from [11, Lemma 30]. For any two 
states p,q € Q let Apaq = (QU {q0}; Z, 95, Apsq. {q}, C) where 
Ap=q = {(q1, a, v, q2) | (q1, a, v, q2) € A, q1 € F) U { (qo & v, q2) | 
(p,a, v, q2) € A}. Hence, if we interpret Ap—q as a finite word PA, 
then it accepts words all accepted by the finite word PA A when 
starting in p, ending in q, and not visiting an accepting state in- 
between. In other words, if p, q € F, then Apo g accepts all finite 
infixes that the strong reset PA A may read when the last reset 
was in p, and the next reset is in q. Now let Apaq be defined 
as Ap=q, but C is complemented. Consider for all p,q € F the 
finite-word PA Ap=q. If at least one of these PA accepts at least 
one word, then the strong reset PA A is not universal. To see this, 
assume that Ap=q accepts a word w € =*. Furthermore, let v € >* 
be an arbitrary word such that (the unique run of) A is in state p 
after reading v. As p is an accepting state which enforces a reset, the 
counters of A are all 0 after reading v. Now, if we feed w to A, the 
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automaton reaches the accepting state q (without seeing any other 
accepting state in between by the definition of Apoq)s and hence 
rejects at this point, as the counter values are bad. Hence, A rejects 
any infinite word with prefix vw, and is hence not universal. 

Hence, for every p,q € F we construct a (non-deterministic) 
reach PA that accepts all infinite words of the form vwẸ£® such 
that A is in state p after reading v (there might be several resets 
before reaching p), and w € L(Ap=q)- Finally, we build the union 
of all these automata for all p,q € F and obtain a reach PA Ay 
whose w-language is not empty if and only if there is an infinite 
word such that the unique run of A visits an accepting state with 
bad counter values (Condition 2 of the list above). 

Let B be the Biichi automaton obtained from A by forgetting all 
vectors and let 8 be a Biichi automaton recognizing the complement 
of Lo (8). 

Then A is universal if and only if Ro (Au) U Lo (B) is empty, 
which can be tested by turning both automata into reach-reg. PA, 
which are trivially closed under union [11, Theorem 9]. o 


6.2 Model Checking 


In the classical model checking problem, we are given a system K 
and a specification, e.g. represented as an automaton A, and the 
question is whether every run of K satisfies the specification, i.e., 
we ask L(K) € L(A), which can be equivalently written as L(K) NA 
L(A) = Ø. However, as complementing is often expensive or not 
even possible, another approach is to specify the set of all bad 
runs and ask whether no run of K is bad, which boils down to the 
question is L(K) N L(A) = Ø? We call the first approach universal 
model checking and the latter approach existential model checking. 
In our setting we assume the specification A to be a PA operating 
on infinite words, while the system K may be given as a Kripke- 
structure (which can be seen as a safety automaton [4]), in which 
case the goal is to solve safety model checking, or also as a PA 
operating on infinite words, in which case the goal is to solve PA 
model checking. Hence, we consider four problems in total. 

As shown in [11], the existential safety model checking problem 
for almost all (non-deterministic variants of the) models considered 
in this paper is decidable in coNP, the exception being safety PA 
and co-Büchi PA. 


THEOREM 6.4 ([11]). Existential safety model checking is coNP- 
complete for reach PA, reach-reg. PA, limit PA Biichi PA, strong re- 
set PA, and weak reset PA. 


Hence, this problem is also decidable in coNP for their deter- 
ministic variants. The matching lower-bounds follow from an easy 
reduction from their emptiness problems by asking whether 2° N 
L(A) = Ø (a safety automaton for X® is easily found). 


Coro.tary 6.5. Existential safety model checking is coNP-complete 
for deterministic reach PA, deterministic reach-reg. PA, deterministic 
limit PA Biichi PA, deterministic strong reset PA, and deterministic 
weak reset PA. 


Guha et al. [12] have shown that emptiness is undecidable for 
deterministic safety PA and deterministic co-Büchi PA. Hence, their 
existential safety model checking problem is undecidable. 


Coro.iary 6.6. Existential safety model checking is undecidable 
for deterministic safety PA and deterministic co-Biichi PA. 


Similarly, the universal model checking problems are undecid- 
able for all models that already have an undecidable universal- 
ity problem, as we can easily reduce from universality by asking 
whether X° C L(A). Hence, we obtain the following corollary as 
an immediate consequence of Lemma 6.3 and the results in [12]. 


COROLLARY 6.7. Universal safety model checking and universal 
PA model checking are undecidable for deterministic reach PA, de- 
terministic reach-reg. PA, deterministic Biichi PA and deterministic 
weak reset PA. 


Guha et al. [12] have shown that the universal PA model checking 
problem is decidable for deterministic safety PA and deterministic 
co-Biichi PA. We note that this is also the case for deterministic 
limit PA, which follows from their closure properties. Furthermore, 
we show that the universal PA model checking problem is decid- 
able for deterministic strong reset PA. As shown in Lemma 6.3, the 
complement w-languages of deterministic strong reset PA are rec- 
ognized by reach-reg. PA. Hence, given two deterministic strong re- 
set PA Ay, Ag, the question whether SRo (A1) © SRo (Az) (which 
is equivalent to the question whether SRo (A1) N SRw(Az2) = Ø) 
boils down to deciding intersection emptiness of a deterministic 
strong reset PA and a reach-reg. PA. 

We first show that deciding intersection emptiness of a deter- 
ministic strong reset PA recognizable w-language and an w-regular 
language is decidable. To achieve that, we begin by showing that 
the intersection of a deterministic strong reset PA recognizable 
w-language and an w-regular language is still ultimately periodic. 


LEMMA 6.8. Let A = (Q1, È, pr, A1, Fi, C) be a deterministic strong 
reset PA and B = (Qo, È, qr, Ag, F2) be a Biichi automaton. Then 
SR (A) N Lo (B) is ultimately periodic. 


Proor. Assume SRo (A) N Lo(8) + Ø and let a be an in- 
finite word accepted by both automata, A and B. If a = uv® 
for some u,v € ÈŁ*, we are done. Hence assume that this is not 
the case. Let A = (Qi X Qo, È, (pr, qr), A, Fi X Q2,C) with A = 
(q) a v, (p^q)) | (pav, p’) € A1, (qaq) € A2} be the 
product automaton! of A and B. As a € SRo (A), the unique 
accepting run (po, @1, V1, p1) (p1, a2, V2, p2)... with po = py is 
accepting. Likewise, as a € Lo(8), there is an accepting run 
(qo, 1, 91)(q1, 02,92)... with qo = qr of B on a. Hence, r = 
((po. q0), #1, V1; (P1; q1)) ((p1, q1), @2, V2, (p2, q2))... 
A on a with the following properties: 


is a run of 


e there is pr € Fy such that for infinitely many i we have p; = 
pf- Let fi, f2,... denote the positions of all occurrences of 
a state of the form (py, -) inr. 
e there is qf € Fo such that for infinitely many i we have 
qi = qf- 
Let j > fi be minimal such that qj = qf. Now let k < j be maximal 
such that k = fe for some £ > 1. Then r[1: felr[fe +1: feri]® 
is an accepting run of A on an ultimately periodic word, say uv®, 


that visits an accepting state of B infinitely often. Hence uv® € 
SRo (A) N Le (B). m 


We note that A interpreted as a strong reset PA does not recognize SRo (A) N 
Lo (8). Instead, it accepts all infinite words a € SRo (A) such that B has an infinite 
but not necessarily accepting run on a. 


LEMMA 6.9. Let A be a deterministic strong reset PA and let B be 
a Biichi automaton. The question SRo (A) N La (8) = Ø is coNP- 
complete. 


Proor. Hardness is obvious; hence, we focus on the contain- 
ment in coNP. By the previous lemma it is sufficient to check the ex- 
istence of an ultimately periodic word. Let A = (Q1, È, po, A1, F1, C) 
and B = (Q92, È, qo, Ag, F2). Recall the algorithm in [11, Lemma 30] 
that decides the non-emptiness problem for reset PA in NP by ex- 
ploiting that every non-empty w-language accepted by a strong 
reset PA contains an ultimately periodic word. This algorithm ba- 
sically guesses an accepting state p of A that is seen infinitely 
often, and a sequence of distinct accepting states p1 ... Pn such that 
pi = p for some i < n. Then, the algorithm tests for all 0 < i < n 
whether the finite word PA Ap;=p;,, accepts at least one word, and 
whether Ap, >p accept at least one word (where Ap=q is defined 
as in the proof of Lemma 6.3). We modify the algorithm as follows. 

First, let A be the product automaton of A and $B (as in the 
previous proof; however, the set of accepting states is not important 
for the algorithm). We guess a state q € Fz that we expect to 
be seen infinitely often to satisfy the acceptance condition of B. 
Furthermore, similar to the algorithm above we guess a sequence of 
distinct states (p1,q1)(p2, q2) - - - (Pn, qn) such that for some £ < n 
we have qe = q, for some i < £ we have p; = p, and for all j + £ 
we have that p; is accepting in A. If the sequence contains a state 
(pi, qi) € Fy X Fo, we can interpret A as a reset PA with accepting 
states Fj X Q2 and run the algorithm, as the Büchi condition is 
automatically satisfied. 

Hence assume that pe ¢ Fı and qj ¢ Fə for all j + £. Let 


A be the finite word PA that accepts all finite infixes ac- 


qe 
pe-1> peri 


cepted by the product automaton A when starting in (pr-1, qe-1), 
visiting (pp, gg) at some point, and ending in (pe+1, ge+1) such that 
for all internal states (pj, qi) we have p; ¢ F1. Two achieve this, we 
take two copies of A, where all accepting states in the first copy 
are not reachable, all accepting states in the second copy have no 
outgoing transitions, and the second copy can only be reached from 
the first copy via (pe, qe). 
Formally, let 


A = (Qi x Q2 x {1, 2} U {qo}: x, do A’, {(Pe+1, qe+1)}, C) 


PeaSpen 
with 

A’ ={((p.q,1),a, v, (p,q, 1) | (p.g.av. (p,q) E App’ ¢ Fi} 
U {((p, 4, 2),4,v, (p’,q’,2)) | ((p.q).av. (p^ q')) € A p £ Fi} 

U {((p,. q, 1), a, v, (pe, qe, 2) | (Cp. q), a, v, (pe, qe)) € A} 

U {(qo vs (p’, 4’, 1) | ((pe-1, qe-1), 4, V, (p',q’)) E A p € Fi} 
U {(qo; & V, (pes qe, 2) | ((pe-1; qe-1), a v, (pe, qe)) € A}. 


Now the algorithm is similar to the original non-emptiness al- 
gorithm for reset PA. For every 0 < j < £- landf£+1<j<n 
we test Alp ;qj)= (pridy) a$ well as A pn,qn)=>(piqi) fOr non- 


emptiness. Furthermore, we test A qe for non-emptiness. 


Pe-1> Pe 
If all these automata accept at least one word, we conclude that 


SRo (A) N Lo (8) # Ø, as the guess of our sequence implies that 
at least one accepting state of B is seen infinitely often, while the 
rest follows from the correctness of the algorithm in [11]. o 
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In order to show that testing intersection emptiness of a de- 
terministic strong reset PA and a reach-reg. PA is decidable, we 
combine the algorithm in the previous proof with the NP-algorithm 
in [15] deciding the reachability problem for Z-VASS with k nested 
zero-tests (Z-VASS_”). A Z-VASS,? (of dimension d > 1) is a tuple 
V = (Q, Z, E) where Q is a finite set of states, Z C {0,1,...,d} is 
its set of zero tests with |Z \ {0}| = k, and EC Q x Z4 x Z x Q 
is a finite set of transitions. A configuration of V is a pair (p, v) € 
Q x Z4. Assume v = (v1,...,0g). We write (p.v) ty (p’,v’) if 
there is a transition (p,u,f,p’) € E such that v’ = v + u and 
vı = +++ = vg = 0. Furthermore, we write (p,v) +}, (p’, v’) if 
there is a sequence (p1,v1) Fy ++ Fy (Pn, Vn) for some n > 1 
such that (p, v) = (p1, v1) and (p’, v’) = (pn, Vn). The reachability 
problem for Z-VASS_” is defined as follows: given a Z-VASS/? V 
and two configurations (p, v), (p’, v’), does (p, v) F} (p’, v’) hold? 
As shown in [15], this problem is NP-complete? for any fixed k. 


LEMMA 6.10. Let Ay be a deterministic strong reset PA and let A2 
be a reach-reg. PA. The question SRo (A1) VRRw(Ag) = Ø is coNP- 
complete. 


Proor. Let Aı = (Q1, È, po, A1, Fi,C) be of dimension dı and 
Ag = (Q2, È, go, A2, F2, D) of dimension də. By [11, Theorem 9] we 
can write RRo (A2) as U; UiV?, where the Uj are finite word PA 
languages, and V; are regular languages (in fact, the number of sets 
in the union is polynomially bounded by |Q2| and we can compute 
automata for these languages in polynomial time). 

The idea for the proof of the lemma is as follows. Suppose 
SRo (Ay) N RRo (A2) + Ø and let a be an infinite word accepted 
by both automata. We can write a = uf such that u € U; for some i. 
Let (p,v) € Qi X N% be the configuration of A, after reading u 
(as Ay is deterministic, there is a unique partial run of A on u, 
and as a = uf € SRo (A1), every visit of an accepting state while 
reading u is with good counter values). Hence, if we can verify 
the existence of such a word u and compute (p, v), we can use the 


algorithm in the previous lemma to test SAP) N LolB) #@ 


where AP V) is defined as Aj but with initial configuration (p, v) 
(such a PA can be obtained from A, by adding a fresh initial state 
that inherits all transitions from p and adds v to them) and $ is a 
Biichi automaton for V®. 

In fact, we guess the existence of two finite words u and v such 
that (1) there is an infinite word £ with uvB € SRo (A1) NRRw(A2) 
(2) u € Ui for some i and (3) the unique partial run of Aj is in an 
accepting state after reading uv, and every visit of an accepting 
state while reading uv is with good counter values. We verify (2) 
and (3) using the NP-algorithm for the reachability problem for 


Z-VASS,”, yielding a deterministic strong reset PA AP) for a 


configuration (p,v) € Qı X N% and a Büchi automaton B as 
described above, which we use to call the algorithm in the previous 
lemma. To be precise, we build a product Z-VASS;7 V with dı + d2 
many counters. This system works in two phases: in the first phase 
it tests the existence of u ensuring that every visit of an accepting 
state of A, is with good counter values using a zero test on the 


We note that our definition of Z-VASS(” differs slightly from the definition in [15], 


as we allow E C Q x Z? x Z x Q instead of E C Q x {-1,0,1}4 x Z x Q only. 
However, this difference does not change the mentioned complexity for the reachability 
problem [15], see also [1, Section A.1]. 
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first dı counters. After finding such a u, the system transitions into 
the second phase in which the last dz counters are not modified 
any more, and we check the existence of a v as mentioned above. 
After this check all counter are 0. 

Let us give some more details on how to verify that every visit of 
an accepting state implies good counter values. Let C = C(b1, P1) U 
---UC(b x, Pk) for some k > 1. For every accepting state f € F1 
we insert k states, say f, i3 o f®, and a copy of f itself. We 
connect f to f © with a transition with update —b; and no zero-test. 
Then, for every period vector p; € P;, we insert a loop on f © with 
update —pj;. Finally, every outgoing transition of f © is equipped 
with a zero-test on the first dı counters. This construction allows 
us to test membership of the current counter values in C, while 
resetting the counters in parallel. 

Let D = C(c1, R1) U---UC(ce, Re) for some £ > 1. Formally, we 
define V = (Q, {0, di, d1 + d2}, E) where 


Q=Q1x Q2 x {1,2} U {Ff | fe Fpi < k} 


(i) 40) ; F 
U {ep ode a fa | f €Fi.g€ Q2,i <k, j <£} 


and 


E ={((p.q, 1), u: v,0, (p’,g', 1) | 
Ja € È: (p,a, u, p) € A1, (q,a, v, q) € Ao, p ¢ Fi} 
U {((p, q, 2), u - 0,0, (p’, q’, 2)) | 
Jac Zw eNĖ: (p,a, u, p’) € Aj, 
(q,a, v, q’) € A2, p ¢ Fi} 
U {g 1), -bs - 0,0, (f®,q)) | f € Fi,q € Q2,i < k} 
u {FË q), -pi 0,0, (F,4)) | 
f € Fi,q € Q2,pi € Pii < k} 
U (FË, a), u-v, di, (p,q, 1)) | 
FaeX: (fia u, p’) € Ai, (q,a, V, g) € Ag, 
feF,i<k} 
U {((p. g, 1), u- 0,0, (p, g’, 2)) | 
Jace Zw ENE: (p.a, u, p’) € Ai, (g,a, v, q’) € Ao, 
p4 Fi, gE Fo} 
U{((f, 9,1), u- 0, di, (0q, 2) | 
Fae SaveN®: (f,a,u, p’) € A1, (g,a, v, q) € Aa, 
feF,geF,i< k} 
gD, -bi : 0,0,c®) | f € Fasq € Q2,i < k} 
(Ce, -pi 0,0,e¢)) | f € Fisq € Q2, pi € Phi < k} 


e 0- —cj,0,dH) | f € Fig E€ Qai < kj < e} 


c 


c 


c 


c 


tat), o --1j,0, dy?) | f €Fi,qg€ Qo,rj E Rij < 8} 


(dY? 0, dı + da, epg) | f € Fig € Q2, j <b}. 


c 


Observe that V is computable in polynomial time. 
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We are now ready to present an NP-algorithm deciding whether 
SRo (A1) A RRo (A2) # Ø. 
(1) Guess f € Fı and q € Qo. 
(2) Construct V as above and test ((po, qo, 1), 0) +4, (epg 0). 
(3) Finally, use the algorithm in the previous lemma to test 
SRo (ap) N Le (Bq) # Ø, where Bg is the Biichi automa- 
ton obtained from A? by forgetting all vectors (and drop- 
ping C2), and setting q as its initial state. 
If all tests succeed, we conclude that the intersection of SRo (A1) 
and RR, (A2) is not empty. o 


COROLLARY 6.11. Universal safety model checking and universal 
PA model checking are decidable for deterministic limit PA and de- 
terministic strong reset PA, deterministic safety PA and deterministic 
co-Büchi PA. 


Recall that the existential PA model checking problem can equiv- 
alently be expressed as an intersection emptiness problem. As (non- 
deterministic) reach PA are closed under intersection and have a 
decidable emptiness problem, the existential PA model checking 
problem is decidable for them and hence also for their deterministic 
variants. This is also the case for reach-reg. PA: they are equivalent 
to limit PA [11], and we can show that limit PA are closed under 
intersection using the same argument as in the deterministic setting 
(see Lemma 5.2). 

To show that the existential PA model checking problem is decid- 
able (even for non-deterministic) Büchi PA, we use a recent result 
essentially stating that Ramsey-quantifiers in Presburger formulas 
can be eliminated in polynomial time [3]. Furthermore, the authors 
show how to use the Ramsey-quantifier to check liveness proper- 
ties for systems with counters. In particular, the existence of an 
accepting run of a Büchi PA (answering the question whether the 
accepted w-language is non-empty) can be expressed with a Pres- 
burger formula with a Ramsey-quantifier. Hence, checking if the 
intersection of the two w-languages recognized by two Biichi PA 
can be tested by intersecting two Presburger-formulas and moving 
the quantifiers to the front. We refer to sections 4.1 and 8.2 in [3] 
for more information. 


COROLLARY 6.12. Existential PA model checking is decidable for 
(deterministic) reach PA, (deterministic) reach-reg. PA, (deterministic) 
limit PA, and (deterministic) Büchi PA. 


We show that deciding whether the intersection of two w-lan- 
guages recognized by deterministic strong reset PA is empty is 
undecidable. The result relies on the fact that the intersection of 
two such languages can encode non-terminating computations of 
two-counter machines. 

A two-counter machine M is a finite sequence of instructions 


(1: h)(2: l2)... (k-1 :lg-1)(k : STOP) 


where the first component of a pair (£, l¢) is the line number, and 
the second component is the instruction in line £. An instruction is 
of one of the following forms: 
e Inc(Z;), where i = 0 ori=1. 
e Dec(Z;), where i=0 ori =1. 
e If Zi = 0 goto £’ else £”, where i = 0 ori=1,andf’,t” < 
k. 


Instructions of the first or second form are called increments 
resp. decrements, while instructions of the latter form are called 
zero-tests. A configuration of M is a tuple c = (f, zo, z1), where 
£ < k is the current line number, and zo, z; € N are the current 
counter values of Zo and Z4 respectively. We say c derives into its 
unique successor configuration c’, written ct c’, as follows. 


e If lp =Inc(Zo), then c’ = (£ + 1, zo + 1,21). 

e Ifl; = Inc(Z1), then c’ = (£ + 1,z0,z1 + 1). 

e Ifl; = Dec(Zo), then c’ = (£ + 1, max{zg — 1, 0}, z1). 

e Ifl; = Dec(Z1), then c’ = (£ + 1, zo, max{zı — 1, O}). 

e If le = If Zo = 0 goto £’ else £”, then c’ = (€’, zo, 21) if 
zo = 0, and c’ = (£”, zo, z1) if zo > 0. 

e Ifl = If Z1 = 0 goto £’ else £”, then c’ = (€’, zo, 21) if 


zı = 0, and c’ = (£”, zo, z1) if z1 > 0. 
e If lp = STOP, then c has no successor configuration. 


The unique computation of M is a finite or infinite sequence of 
configurations coc1c2 ... such that co = (1,0,0) and ci + ci+1 for 
all i > 0. Observe that the computation is finite if and only of the 
instruction (k : STOP) is reached. If this is the case, we say M 
terminates. Given a two-counter machine M, it is undecidable to 
decide whether M terminates or not [21]. 

In the following we assume w.l.o.g. that our two-counter ma- 
chines satisfy the guarded-decrement property [12] which guar- 
antees that every decrement does indeed change a counter value: 
every decrement (£ : Dec(Z;)) is preceded by a zero-test of the 
form (£ — 1, If Z; = 0 goto £ + 1 else £). Note that this modifica- 
tion does not change the termination behavior of a two-counter 
machine, as decrementing a counter whose value is already zero 
does not have an effect. 


LEMMA 6.13. The intersection emptiness problem for deterministic 
strong reset PA is undecidable. 


Proor. We can encode infinite computations of two-counter 
machines as infinite words over = = {a, b, 1,2,...,k} UX), where 
X1 = {las Ip, Da, Dp, Za, Zp, Za, Zp}. The idea is as follows. Let c = 
(£,Z9,Z1) be a configuration of M. We encode c as a finite word 
We = tux € &*, where £ € {1,2,...,k} encodes the current line 
number, u € {a,b}* with |u|g = zo and |u|, = zı encodes the 
current counter values, and x € >) encodes the instruction lp of 
line £ as follows: 


e Ifle = Inc(Zo), then x = Ig, and if lp = Inc(Z1), then x = Ip. 

e If lp = Dec(Zo), then x = Dg, and if ly = Dec(Z}), then 
x = Dp. 

e Ifle = If Zo = 0 goto £?’ else £”, and the line number of the 
unique successor configuration of c is ¢’, then x = Za (that 
is, the zero-test is successful). Analogously with x = Zp. 

e Ifl; = If Zo = 0 goto £?’ else £”, and the line number of the 
unique successor configuration of c is £”, then x = Za (that 
is, the zero-test fails). Analogously with x = Zp. 


Let we, we’ € &* be two words encoding two configurations 
of M. We call we-wer correctif c + c’. Hence, we can encode a unique 
infinite computations coc1c2 ... as an infinite word we, We, We, ---- 
We show that the w-language L = {weg We, We, ... } can be written 
as the intersection of two deterministic strong reset PA w-languages. 
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Let 
Ly = {Weg We, Wea *** | Wen; Wezi; Is correct for every i > 0}, and 
Lo = {Weg We, Wea *** | Weoix1 Weojx iS correct for every i > 0}. 


Observe that Lı N L2 = L, and L is empty if and only if the 
unique computation of M terminates. Hence, it remains to show 
that Lı and Lo are recognized by deterministic strong reset PA. 
We argue for L1; the argument for L2 is very similar. The idea 
is as follows: We construct a deterministic strong reset PA A, 
with five counters that tests the correctness of two consecutive 
encodings of configurations, say Wey; * Wes;,, = €1U1x1 + f2u2x2 
with ¢1,f2 € {1,2,...,k}, uju2 € {a,b}* and x1,xq €  . First 
observe that checking whether f is indeed the correct line number 
(that is, the correct successor of f1) can be hard-coded into the 
state space of Aj: if xı encodes an increment or decrement, we 
expect f2 = fı + 1, and if xı encodes a successful or failing zero-test 
If Zi = 0 goto f’ else £”, we expect f2 = £’ or f = £”, respectively. 
Four counters of A, are used to count the numbers of a’s and 
b’s in uy and ug, respectively. Then, if x = Ig, we expect |ua|q = 
luila + 1 and |u2|, = |u1|p, and so on. To be able to perform the 
correct check, we also encode x into the state space as well as the 
fifth counter by counting modulo |2)|. Observe that the guarded- 
decrement property ensures that decrements are handled correctly. 
Hence, Aj has two sets of states counting the numbers of a’s and 
b’s of uy and ug, accordingly, as well as a set of accepting states 
that is used to check the counter values. 

After such a check, A, resets, and continues with the next two 
(encodings of) configurations. The automaton for Lo works in the 
same way, but skips the first configuration. o 


As shown, the intersection emptiness problem for deterministic 
strong reset PA is undecidable, implying the same for deterministic 
weak reset PA, and hence their existential PA model checking prob- 
lems. Recall that this problem is also undecidable for deterministic 
safety PA and deterministic co-Büchi PA. 


COROLLARY 6.14. Existential PA model checking for deterministic 
strong reset PA, deterministic weak reset PA, deterministic safety PA 
and deterministic co-Büchi PA is undecidable. 


7 CONCLUSION 


We have studied the deterministic variants of weak reset PA, strong 
reset PA, reach-reg. PA, and most notably limit PA. The latter are 
closed under the Boolean operations and hence all common decision 
problems are decidable for them, including the classical model 
checking problems. Closely related to model checking problems 
are synthesis problems. Here, the problem is to generate a model 
from a system specification (which is correct by construction). Gale- 
Stewart games play a key role in solving such synthesis problems [9]. 
However, these games are undecidable when winning conditions 
are specified by automata whose emptiness or universality problem 
is undecidable. Our decidability results for deterministic limit PA 
raise the interesting and important question whether Gale-Stewart 
games can be solved when their winning condition is expressed by 
these automata. 

In future work we further plan to study the regular separability 
problem for these models, that is, given two w-languages L1, Lo 
recognized by PA operating on infinite words, is there an w-regular 
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language L with Lı G L and L2 N L = Ø. Solving this problem can 
be used as an alternative approach to solving existential PA model 
checking, as (regular) separability implies intersection emptiness. 
It has already been studied for some related models, e.g. PA on 
finite words [5] and Biichi VASS [2]. Furthermore, it remains to 
classify the intersections of all incomparable models and thereby to 
provide a fine grained “map of the universe” for Parikh recognizable 
w-languages. 
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